Emit invariant.group.barrier when using union field

[Prazek]

Summary

We need to emit barrier if the union field
is CXXRecordDecl because it might have vptrs. The testcode
was wrongly devirtualized. It also proves that having different
groups for different dynamic types is not sufficient.

[Prazek]

ping

[Prazek]

ping

[rjmccall]

lib/CodeGen/CGExpr.cpp

3577

Checking for v-table pointers recursively isn't really that difficult, but if you really don't want to do that, please at least check for non-POD-ness or something so that this isn't kicking in for literally every struct type.

[Prazek]

lib/CodeGen/CGExpr.cpp

3577

ok, I am also planning to fix this in the later patch, because the same problem arise when comparing 2 pointers to dynamic classe.
I would like to have a bit in CXXRecordDecl to remember if it has any vptr inside that would calculate durring the construction.
My biggest fear is that if I won't cache it then it will be very slow.

[rjmccall]

lib/CodeGen/CGExpr.cpp

3577

We could repeat this work from scratch on every single union field access done by IRGen and it would still be way, way faster than doing anything extra on every record definition in the program. The latter is done orders of magnitude more frequently than the former.

[Prazek]

lib/CodeGen/CGExpr.cpp

3577

This is a good point, and actually I don't need to check if class holds any vptrs for the example I refered (comparing 2 pointers).
Hovewer I still need to do it when someone casts pointer to class holding vptrs to something that doesn't hold vptrs, and any pointer casts are much more frequent than Record declarations.

[rjmccall]

lib/CodeGen/CGExpr.cpp

3577

What are you planning to do if someone casts to a pointer to incomplete type?

I am concerned that what these problems are really telling us is that this representation is not very good.

[Prazek]

lib/CodeGen/CGExpr.cpp

3577

In this case we also need to add the barrier. I might be wrong, but I think this in general should be pretty rare and even more rare if it would limit the devirtualization.
For example cases like:

Derived *d;
(Base*)d;

will not limit devirtualization if Derived is complete type (because base will be also).

The other thing is that with my recent patches, adding more barriers will not limit any memory optimizations.

[Prazek]

• Checking for vptrs

[Prazek]

For now I will check if it has any vptrs. It will be probably soon stored in the CXXRecordDecl because it will be used much more frequently when generating barriers for pointer casts.

[Prazek]

• format

[Prazek]

• Inserting barrier with -O0

[Prazek]

Ping

[rjmccall]

lib/CodeGen/CGExpr.cpp

3530

You need to recurse into base classes (to check their fields), and if you write this to take a QualType you won't have to eagerly extract RD below.

3577

You don't need the .getTypePtr() here.

[Prazek]

• changed to QualType, now it is much cleaner

[Prazek]

lib/CodeGen/CGExpr.cpp

3530

Cool, thanks for the tip

[rjmccall]

Looks great, thanks. One request for additional tests, but feel free to commit when that's ready.

test/CodeGenCXX/strict-vtable-pointers.cpp

258

Please include test cases involving classes that only have a virtual pointer in a field of a base class — e.g. something that inherits from HoldingVirtuals. And be sure to cover both normal and virtual inheritance.

[Prazek]

Add test

[rjmccall]

test/CodeGenCXX/strict-vtable-pointers.cpp

263

"virtual" applies to an individual base, not to all following bases. You need "virtual HoldingVirtuals" here.

Although, come to think of it, having a virtual base should already ensure that the class has a v-table, even if it has no other reason for one. (You should add a test for that!)

[Prazek]

Extra test

[rjmccall]

Thanks, LGTM.

lib/CodeGen/CGExpr.cpp

if (idx != 0) {
     auto &recLayout = CGF.getContext().getASTRecordLayout(rec);
     auto offsetInBits = recLayout.getFieldOffset(field->getFieldIndex());
     offset = CGF.getContext().toCharUnitsFromBits(offsetInBits);
   }
 
   return CGF.Builder.CreateStructGEP(base, idx, offset, field->getName());
 }
 
+static bool hasAnyVptr(const CXXRecordDecl *RD, const ASTContext &Context) {
+  if (RD->isDynamicClass())
+    return true;
+
+  for (const FieldDecl *Field : RD->fields()) {
+    QualType FieldType = Context.getBaseElementType(Field->getType());
+    const RecordType *RT = FieldType->getAs<RecordType>();
+    if (!RT)
+      continue;
+    auto *FieldClassDecl = cast<CXXRecordDecl>(RT->getDecl());
+    if (hasAnyVptr(FieldClassDecl, Context))
+      return true;
+  }
+  return false;
+}
+
 LValue CodeGenFunction::EmitLValueForField(LValue base,
                                            const FieldDecl *field) {
   AlignmentSource fieldAlignSource =
     getFieldAlignmentSource(base.getAlignmentSource());
 
   if (field->isBitField()) {
     const CGRecordLayout &RL =
       CGM.getTypes().getCGRecordLayout(field->getParent());
LValue CodeGenFunction::EmitLValueForField(LValue base,
   Address addr = base.getAddress();
   unsigned cvr = base.getVRQualifiers();
   bool TBAAPath = CGM.getCodeGenOpts().StructPathTBAA;
   if (rec->isUnion()) {
     // For unions, there is no pointer adjustment.
     assert(!type->isReferenceType() && "union has reference member");
     // TODO: handle path-aware TBAA for union.
     TBAAPath = false;
+
+    const auto *RD = field->getType().getTypePtr()->getAsCXXRecordDecl();
+    if (CGM.getCodeGenOpts().StrictVTablePointers &&
+        CGM.getCodeGenOpts().OptimizationLevel > 0 && RD &&
+        hasAnyVptr(RD, getContext()))
+      // Because unions can easily skip invariant.barriers, we need to add
+      // a barrier every time CXXRecord field with vptr is referenced.
+      addr = Address(Builder.CreateInvariantGroupBarrier(addr.getPointer()),
+                     addr.getAlignment());
   } else {
     // For structs, we GEP to the field that the record layout suggests.
     addr = emitAddrOfFieldStorage(*this, addr, field);
 
     // If this is a reference field, load the reference right now.
     if (const ReferenceType *refType = type->getAs<ReferenceType>()) {
       llvm::LoadInst *load = Builder.CreateLoad(addr, "ref");
       if (cvr & Qualifiers::Volatile) load->setVolatile(true);

test/CodeGenCXX/strict-vtable-pointers.cpp

-// RUN: %clang_cc1 %s -I%S -triple=x86_64-apple-darwin10 -fstrict-vtable-pointers -disable-llvm-passes -O2 -emit-llvm -o %t.ll
+// RUN: %clang_cc1 %s -I%S -triple=x86_64-apple-darwin10 -fstrict-vtable-pointers -std=c++11 -disable-llvm-passes -O2 -emit-llvm -o %t.ll
 // RUN: FileCheck --check-prefix=CHECK-CTORS %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-NEW %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-DTORS %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-LINK-REQ %s < %t.ll
 
 typedef __typeof__(sizeof(0)) size_t;
 void *operator new(size_t, void*) throw();
 

 // CHECK-CTORS: store {{.*}} @_ZTV22DynamicDerivedMultiple, i32 0, inrange i32 1, i32 2) {{.*}} %[[THIS12]]
 // CHECK-CTORS-LABEL: {{^}}}
 
 struct DynamicFromStatic;
 // CHECK-CTORS-LABEL: define linkonce_odr void @_ZN17DynamicFromStaticC2Ev(
 // CHECK-CTORS-NOT: @llvm.invariant.group.barrier(
 // CHECK-CTORS-LABEL: {{^}}}
 
+struct A {
+  virtual void foo();
+};
+struct B : A {
+  virtual void foo();
+};
+
+union U {
+  A a;
+  B b;
+};
+
+void changeToB(U *u);
+void changeToA(U *u);
+
+void g2(A *a) {
+  a->foo();
+}
+// We have to guard access to union fields with invariant.group, because
+// it is very easy to skip the barrier with unions. In this example the inlined
+// g2 will produce loads with the same !invariant.group metadata, and
+// u->a and u->b would use the same pointer.
+// CHECK-NEW-LABEL: define void @_Z14UnionsBarriersP1U
+void UnionsBarriers(U *u) {
+  // CHECK-NEW: call void @_Z9changeToBP1U(
+  changeToB(u);
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z2g2P1A(%struct.A*
+  g2(&u->b);
+  // CHECK-NEW: call void @_Z9changeToAP1U(%union.U* %6)
+  changeToA(u);
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // call void @_Z2g2P1A(%struct.A* %a)
+  g2(&u->a);
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+}
+
+struct HoldingVirtuals {
+  A a;
+};
+
+struct Empty {};
+struct AnotherEmpty {
+  Empty e;
+};
+union NoVptrs {
+  int a;
+  AnotherEmpty empty;
+};
+void take(AnotherEmpty &);
+
+// CHECK-NEW-LABEL: noBarriers
+void noBarriers(NoVptrs &noVptrs) {
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: 42
+  noVptrs.a += 42;
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z4takeR12AnotherEmpty(
+  take(noVptrs.empty);
+}
+
+union U2 {
+  HoldingVirtuals h;
+  int z;
+};
+void take(HoldingVirtuals &);
+
+// CHECK-NEW-LABEL: define void @_Z15UnionsBarriers2R2U2
+void UnionsBarriers2(U2 &u) {
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: 42
+  u.z += 42;
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z4takeR15HoldingVirtuals(
+  take(u.h);
+}
 
 /** DTORS **/
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN10StaticBaseD2Ev(
 // CHECK-DTORS-NOT: call i8* @llvm.invariant.group.barrier(
 // CHECK-DTORS-LABEL: {{^}}}
 
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN25DynamicFromVirtualStatic2D2Ev(
 // CHECK-DTORS-NOT: invariant.barrier
 // CHECK-DTORS-LABEL: {{^}}}
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN17DynamicFromStaticD2Ev
 // CHECK-DTORS-NOT: call i8* @llvm.invariant.group.barrier(